好久没做这么爽了噜
DK盾云服务器： https://www.dkdun.cn/
最近活动是香港的1-1-3 9.9/月

Misc

Welcome

进discord群签到即可

Mic check

就是他说什么就重复什么即可

from pwn import *
context.log_level="debug"
p = remote('34.121.62.108',31646)

for i in range(1, 101):
    response = p.recvuntil(b'submit test words > ').decode()
    word = response.split('>')[1].split('[')[0].strip()
    p.sendline(word.encode())
p.recv()
p.recv()

flag_injection

题目是这样的

from string import ascii_lowercase
from time import sleep
from os import getenv

ALPHABET     = set(ascii_lowercase + "_")
SECRET_FLAG  = getenv("FLAG", "DEAD{test_flag_which_is_exactly_this_long}")
SECRET_FLAG  = SECRET_FLAG.replace("{", "_").replace("}", "_").replace("DEAD","dead")

assert len(SECRET_FLAG) == 42, "Bad flag length"
assert set(SECRET_FLAG).issubset(ALPHABET), "Bad flag chars"

def get_flag():
    print(SECRET_FLAG)

def split_flag():
    start_offset = int(input("Start of flag substring: "))
    end_offset   = int(input("End of flag substring: "))
    new_flag     = SECRET_FLAG[start_offset:end_offset]
    assert       len(new_flag) >= 13, "Can't have such a small piece"
    anything     = input("Anything to add? Tell me: ").strip()[:20]
    assert       set(anything).issubset(ALPHABET), "That's a crazy thing to add!"
    new_flag     += anything
    globals()[new_flag] = ":)"

if __name__ == "__main__":
    split_flag()
    what_to_do = input("What should I do now? Tell: ")
    if not set(what_to_do).issubset(ALPHABET):
        print("Plz no hack :(")
    else:
        # No brute force for you. Test locally instead!
        sleep(10)
        print(eval(what_to_do))

弄了好一会，在本地都不知道怎么弄，毕竟只能用小写和下划线，没得括号可以用

突然发现会这样，上午在本地测的时候也遇到了，但是没想到

于是乎尝试让他自己说出flag

dead_ivswjlv

看来太长了是不行的

就一直这样下去就行了

最后拼接，得到dead_ivswjlvahxmifksxjgifrzfhljkdprcaubac_，然后下划线换成括弧，dead的大小写转换一下

验证一下

因此得到flag为DEAD{ivswjlvahxmifksxjgifrzfhljkdprcaubac}

GoLParty

生命游戏，要连续答对题目，我用这个修改的：https://github.com/thomas-broethaler/conways-game-of-life/blob/master/conways_game_of_life.ipynb

然后要注意的点主要就是接收整个情况了

from pwn import *
import numpy as np
from copy import deepcopy


class GameOfLife:

    def __init__(self, cells=[], generations=1):
        self.cells = cells.copy()
        self.generations = generations
        self.dim_y = len(cells)
        self.dim_x = len(cells[0])
        self.cur_dim_y = 0
        self.cur_dim_x = 0

    def get_neighbors(self, y, x):
        neighbor_list = []
        for i in range(y - 1, y + 2):
            if i < 0 or i > (self.cur_dim_y - 1):
                continue
            else:
                for j in range(x - 1, x + 2):
                    if j < 0 or j > (self.cur_dim_x - 1):
                        continue
                    elif i == y and j == x:
                        continue
                    else:
                        neighbor_list.append(self.cells[i][j])
        return neighbor_list

    def check_neighbors(self, cur_cell, neighbor_list):
        next_gen_cell = cur_cell
        alive_count = neighbor_list.count(1)
        if cur_cell == 1:
            if alive_count == 2 or alive_count == 3:
                next_gen_cell = 1
            else:
                next_gen_cell = 0
        else:
            if alive_count == 3:
                next_gen_cell = 1
        return next_gen_cell

    def add_empty_boarder(self, cur_field, cur_dim_y, cur_dim_x):
        new_field = np.zeros((cur_dim_y + 2, cur_dim_x + 2))
        for y, row in enumerate(cur_field):
            for x, cur_cell in enumerate(row):
                new_field[y + 1, x + 1] = cur_cell
        return new_field

    def remove_empty_boarder(self, new_cells):
        new_cells = np.array(new_cells)
        removing = True
        while removing == True:
            if len(new_cells) == 0:
                return [[]]
            elif np.count_nonzero(new_cells[0]) == 0:
                new_cells = np.delete(new_cells, 0, 0)
            elif np.count_nonzero(new_cells[::-1][0]) == 0:
                new_cells = np.delete(new_cells, -1, 0)
            elif np.count_nonzero(new_cells.T[0]) == 0:
                new_cells = np.delete(new_cells, 0, 1)
            elif np.count_nonzero(new_cells.T[::-1][0]) == 0:
                new_cells = np.delete(new_cells, -1, 1)
            else:
                removing = False
        return new_cells

    def evaluate_generations(self):
        self.cells = deepcopy(self.add_empty_boarder(self.cells, self.dim_y, self.dim_x))
        new_cells = deepcopy(self.cells)
        for generation in range(0, self.generations):
            self.cur_dim_y = len(self.cells)
            self.cur_dim_x = len(self.cells[0])
            new_cells = deepcopy(self.add_empty_boarder(new_cells, self.cur_dim_y, self.cur_dim_x))
            self.cells = deepcopy(new_cells)
            for y, row in enumerate(self.cells):
                for x, cur_cell in enumerate(row):
                    neighbor_list = self.get_neighbors(y, x)
                    new_cells[y][x] = self.check_neighbors(cur_cell, neighbor_list)
        new_cells = self.remove_empty_boarder(new_cells)
        return new_cells.tolist()


def get_generation(cells, generations):
    result = GameOfLife(cells=cells, generations=generations)
    return result.evaluate_generations()


context.log_level = "debug"
p = remote('34.44.175.226', 31532)

p.recvuntil(b'Game On :D')

correct_count = 0
first_time = True
while correct_count < 10:
    if first_time:
        initial_grid = p.recvuntil(b'[*]').decode().split('\n')[2:-2]
        first_time = False
    else:
        initial_grid = p.recvuntil(b'[*]').decode().split('\n')[:-2]

    p.recvuntil(b' Enter the number of live cells after ')
    generations = int(p.recvuntil(b' generations: ').decode().split(' ')[0])

    def parse_grid(grid):
        return [[1 if cell == '■' else 0 for cell in row] for row in grid]
    print(len(initial_grid),initial_grid)

    initial_grid_array = parse_grid(initial_grid)

    result_grid = get_generation(initial_grid_array, generations)
    live_cells_after_generations = sum(sum(row) for row in result_grid)

    print(f"Number of live cells after {generations} generations: {live_cells_after_generations}")

    p.sendline(str(int(live_cells_after_generations)).encode())

    response = p.recvline()
    print(response.decode())

    if b'Correct!' in response:
        correct_count += 1
    else:
        exit()

    #b'[+] Correct!\n'
    #b'[*] Game Over! Thank you for playing.\n'
    #b'[+] Congratulations! Here is your flag: DEAD{GoL_P4rty_W4s_4_Fun_4nd_1ntr1gu1ng_G4m3}'

MAN in the middle

这个题吧，昨天想了一天都不知道怎么处理01串，今天刚起来晃了一眼题就想明白了。

首先拿到的是一个音频文件

放大看能发现

因此尝试直接去看十六进制，发现只有32767和-32767这两种。然后每种长度是44个短样本，写个脚本把他转换成01串

def convert_waveform_to_binary(input_file, output_file):
    with open(input_file, 'rb') as f:
        data = f.read()

    binary_data = []
    for i in range(0, len(data), 88):
        sample = data[i:i+88]
        if sample == b'\xFF\x7F' * 44:
            binary_data.append('1')
        elif sample == b'\x01\x80' * 44:
            binary_data.append('0')
        else:
            print(f"Unexpected value: {sample[:8]}... (showing first 8 bytes)")

    binary_string = ''.join(binary_data)

    with open(output_file, 'w') as f:
        f.write(binary_string)

    print(f"Decoded binary data written to {output_file}")

convert_waveform_to_binary('flag.data', 'binary_output.txt') #flag.data是wav的纯data数据，去掉了开头部分

得到01串后，首先会发现不是直接能from binary的，猜测是一种波形编码。

这里经过尝试后没有解出来，第二天才发现是在转换的时候自己弄错了，实际上就直接按照01和10替换成1和0就行。

with open('binary_output.txt', 'r') as file:
    binary_str = file.readline().strip()

converted_str = ""

for i in range(0, len(binary_str), 2):
    pair = binary_str[i:i + 2]
    if pair == "10":
        converted_str += "0"
    elif pair == "01":
        converted_str += "1"
    else:
        pass
    
print(converted_str)
#0110110101100001011011100110001101101000011001010111001101110100011001010111001000100000011001010110111001100011011011110110010001101001011011100110011100100000011010010111001100100000011000010010000001101101011001010111010001101000011011110110010000100000011011110110011000100000011001010110111001100011011011110110010001101001011011100110011100100000011001000110100101100111011010010111010001100001011011000010000001100100011000010111010001100001001000000110100101101110001000000111011101101000011010010110001101101000001000000110010101100001011000110110100000100000011000100110100101110100001000000110111101100110001000000110010001100001011101000110000100100000011010010111001100100000011100100110010101110000011100100110010101110011011001010110111001110100011001010110010000100000011000100111100100100000011101000111011101101111001000000111011001101111011011000111010001100001011001110110010100100000011011000110010101110110011001010110110001110011001011000010000001100101011011100111001101110101011100100110100101101110011001110010000001100001001000000111010001110010011000010110111001110011011010010111010001101001011011110110111000100000011000010111010000100000011101000110100001100101001000000110110101101001011001000110010001101100011001010010000001101111011001100010000001100101011000010110001101101000001000000110001001101001011101000010000001110000011001010111001001101001011011110110010000101110001000000111010001101000011010010111001100100000011101000111001001100001011011100111001101101001011101000110100101101111011011100010000001110011011001010111001001110110011001010111001100100000011000010111001100100000011000100110111101110100011010000010000001100001001000000110001101101100011011110110001101101011001000000110000101101110011001000010000001100100011000010111010001100001001000000111001101101001011001110110111001100001011011000010110000100000011011010110000101101011011010010110111001100111001000000110100101110100001000000110100001101001011001110110100001101100011110010010000001100101011001100110011001100101011000110111010001101001011101100110010100100000011001100110111101110010001000000111001101111001011011100110001101101000011100100110111101101110011011110111010101110011001000000110001101101111011011010110110101110101011011100110100101100011011000010111010001101001011011110110111000101110001000000110010001100101011101100110010101101100011011110111000001100101011001000010000001100010011110010010000001100111001011100010000001100101001011100010000001110100011010000110111101101101011000010111001100101100001000000110110101100001011011100110001101101000011001010111001101110100011001010111001000100000011001010110111001100011011011110110010001101001011011100110011100100000011010010111001100100000011101110110100101100100011001010110110001111001001000000111010101110011011001010110010000100000011010010110111000100000011101100110000101110010011010010110111101110101011100110010000001100011011011110110110101101101011101010110111001101001011000110110000101110100011010010110111101101110001000000111000001110010011011110111010001101111011000110110111101101100011100110010110000100000011010010110111001100011011011000111010101100100011010010110111001100111001000000110010101110100011010000110010101110010011011100110010101110100001011100010000001101001011101000111001100100000011100000111001001101001011011010110000101110010011110010010000001100001011001000111011001100001011011100111010001100001011001110110010100100000011011000110100101100101011100110010000001101001011011100010000001101001011101000111001100100000011100100110111101100010011101010111001101110100011011100110010101110011011100110010000001100001011001110110000101101001011011100111001101110100001000000111010001101001011011010110100101101110011001110010000001100101011100100111001001101111011100100111001100100000011000010110111001100100001000000110010101100001011100110110010100100000011011110110011000100000011000110110110001101111011000110110101100100000011100100110010101100011011011110111011001100101011100100111100100101100001000000110000101110011001000000111010001101000011001010010000001110010011001010110011101110101011011000110000101110010001000000111010001110010011000010110111001110011011010010111010001101001011011110110111001110011001000000110010101101110011000010110001001101100011001010010000001110100011010000110010100100000011100100110010101100011011001010110100101110110011001010111001000100000011101000110111100100000011011010110000101101001011011100111010001100001011010010110111000100000011100110111100101101110011000110110100001110010011011110110111001101001011110100110000101110100011010010110111101101110001000000111011101101001011101000110100000100000011101000110100001100101001000000111010001110010011000010110111001110011011011010110100101110100011101000110010101110010001011100010000001100010011110010010000001100101011011010110001001100101011001000110010001101001011011100110011100100000011101000110100001100101001000000110001101101100011011110110001101101011001000000111001101101001011001110110111001100001011011000010000001110111011010010111010001101000011010010110111000100000011101000110100001100101001000000110010001100001011101000110000100100000011100110111010001110010011001010110000101101101001011000010000001101101011000010110111001100011011010000110010101110011011101000110010101110010001000000110010101101110011000110110111101100100011010010110111001100111001000000110110101101001011101000110100101100111011000010111010001100101011100110010000001110100011010000110010100100000011100100110100101110011011010110010000001101111011001100010000001110011011110010110111001100011011010000111001001101111011011100110100101111010011000010111010001101001011011110110111000100000011011000110111101110011011100110010110000100000011011010110000101101011011010010110111001100111001000000110100101110100001000000110000100100000011100100110010101101100011010010110000101100010011011000110010100100000011000110110100001101111011010010110001101100101001000000110011001101111011100100010000001101000011010010110011101101000001011010111001101110000011001010110010101100100001000000110010001101001011001110110100101110100011000010110110000100000011001000110000101110100011000010010000001110100011100100110000101101110011100110110110101101001011100110111001101101001011011110110111000101110001000000110000101101110011001000010000001101000011001010111001001100101001000000110100101110011001000000111100101101111011101010111001000100000011001100110110001100001011001110011101000100000011001000110010101100001011001000111101101101101001101000110111001100011011010000011001100110101001101110011001101110010010111110011010001011111001101110110100000110011010111110111011100110001011011100111110100100000011001110110111101101111011001000010000001101010011011110110001000100001

得到flag：dead{m4nch3573r_4_7h3_w1n}

Forgotten Password

题目描述是这样的：

I was going to create this extremely easy forensics challenge for you, but accidentally used the flag as the password when I encrypted the archive. This flag is now deleted, and since it is not possible to brute-force it, I guess that means this challenge can no longer be solved, or can it?

给了两个文件，一个加密的zip，一个py文件，内容是这样的：

from io import BytesIO
import os
import subprocess
import pycdlib # pip install pycdlib

try:
    FLAG = open("flag.txt","r").read()
except FileNotFoundError:
    FLAG = "fake_flag_for_testing"

iso = pycdlib.PyCdlib()
iso.new(interchange_level=4)

iso.add_fp(BytesIO(FLAG.encode()), len(FLAG), '/flag.txt;1')

iso.write('challenge.iso')
iso.close()

subprocess.check_output(["zip", "challenge.zip", "challenge.iso", "-P", FLAG])

其实给出这个py文件主要就是生成iso

这里手动也生成两个iso，先单独对比两个iso的区别：

不同点在于生成的时间，但是比赛的iso不清楚时区，所以我就放弃去还原这个

接着用zip压缩这俩文件，分别得到这样的

发现都有32字节的\x00，其实拿到题的时候就想用bkcrack，但是注意到https://github.com/kimci86/bkcrack/blob/master/example/tutorial.md里说的

The not so easy way: deflated file
Let us assume the zip file did not contain the uncompressed spiral.svg.

Then, to guess some plaintext, we can guess the first bytes of the original advice.jpg file from its extension. The problem is that this file is compressed. To run the attack, one would have to guess how those first bytes are compressed, which is difficult without knowing the entire file.

In this example, this approach is not practical. It can be practical if the original file can easily be found online, like a .dll file for example. Then, one would compress it using various compression software and compression levels to try and generate the correct plaintext.

通常来说都是对储存的进行明文，而对于压缩的，很难去做，通常都是有完全相同的文件

这里看到有相同的32字节的00，就在思考是否可以尝试用bkcrack去爆破呢，由于这个00字节虽然是32，但是无法得知是在何处开始

虽然不知道何处开始，但是能观察到创建的例子开头第一个是在61处，第二是在64处，由于只需要12位已知，因此可以折中选择一个，然后用16的大小

首先bkcrack -L challenge.zip看看

bkcrack 1.7.0 - 2024-05-26
Archive: .\challenge.zip
Index Encryption Compression CRC32    Uncompressed  Packed size Name
----- ---------- ----------- -------- ------------ ------------ ----------------
    0 ZipCrypto  Deflate     17ee7183        53248          382 challenge.iso

接着尝试破解.\bkcrack.exe -C .\challenge.zip -c challenge.iso -x 68 0000000000000000000000000000

得到key是6b13ebc5 cc0be8ac 709e18f9

然后.\bkcrack.exe -C .\challenge.zip -k 6b13ebc5 cc0be8ac 709e18f9 -D dec.zip

解压后直接搜索即可

DEAD{weird_how_this_encryption_is_the_default_in_2024}

Crypto

Flag killer

from binascii import hexlify, unhexlify

def FLAG_KILLER(value):
    index = 0
    temp = []
    output = 0
    while value > 0:
        temp.append(2 - (value % 4) if value % 2 != 0 else 0)
        value = (value - temp[index]) // 2
        index += 1
    temp = temp[::-1]
    for index in range(len(temp)):
        output += temp[index] * 3 ** (len(temp) - index - 1)
    return output

output = '0e98b103240e99c71e320dd330dd430de2629ce326a4a2b6b90cd201030926a090cfc5269f904f740cd1001c290cd10002900cd100ee59269a8269a026a4a2d05a269a82aa850d03a2b6b900883'

def reverse_FLAG_KILLER(output_segment):
    for i in range(4096):
        if FLAG_KILLER(i) == int(output_segment, 16):
            return i
    return None

index = 0
reversed_flag = ''
while index < len(output):
    segment = output[index:index+5]
    original_value = reverse_FLAG_KILLER(segment)
    if original_value is None:
        print("Error: No matching value found.")
        break
    reversed_flag += '%03x' % original_value
    index += 5
print(reversed_flag)
#444541447b3236336638373165383830653964633764323430313030303330346663363065393863376335383807d 注意07d改成7d
#-->DEAD{263f871e880e9dc7d2401000304fc60e98c7c588}